fix(docker): reorder build stages so web-build comes after its --from= sources (#2)

Coolify's builder fails the build at parse time with:
  "cannot copy from stage 'collab-build', it needs to be defined before
   current stage 'web-build'"

The previous commit introduced forward COPY --from references that work
on newer BuildKit DAG builders but not on the legacy Docker builder
Coolify uses. Move `collab-build` and `mcp-build` above `web-build` in
lexical order so the references resolve. Functionally identical — the
DAG ordering effect is the same — just expressed in a way the older
builder accepts.

Added a NOTE comment above the stages so the next person who tries to
"clean up" the file order doesn't reintroduce the same regression.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker/Dockerfile

@@ -39,24 +39,12 @@ COPY packages/ai/package.json ./packages/ai/
 RUN pnpm install --frozen-lockfile
 
 
-# ============================================================================
+# NOTE: Stage order matters. `web-build` must be defined AFTER `collab-build`
-# web-build — Next.js production build → standalone output
+# and `mcp-build` because it `COPY --from=`s them to force BuildKit to
-# ============================================================================
+# finish the light tsup builds before starting the heavy Next.js compile.
-FROM deps AS web-build
+# Coolify's builder requires stages referenced via `--from=` to be defined
-COPY apps/web ./apps/web
+# above the referencing stage; forward references fail with "cannot copy
-COPY packages/ai ./packages/ai
+# from stage X, it needs to be defined before current stage Y".
-COPY packages/database ./packages/database
-COPY packages/shared ./packages/shared
-COPY docker/next.config.docker.ts ./apps/web/next.config.ts
-
-ENV NEXT_TELEMETRY_DISABLED=1
-ENV NODE_ENV=production
-# Give the Next.js webpack compile enough V8 heap headroom on the Coolify host.
-# Sized to ~60% of an 8 GB host so kernel + dockerd + buildkit + concurrent
-# tsup workers still have breathing room. Below ~3 GB the compile spirals
-# into GC churn and gets oom-killed (exit 255 with no Docker error).
-ENV NODE_OPTIONS=--max-old-space-size=5120
-RUN pnpm exec turbo build --filter=@tasks/web
 
 
 # ============================================================================
@@ -82,6 +70,36 @@ ENV NODE_ENV=production
 RUN pnpm exec turbo build --filter=@tasks/mcp-server
 
 
+# ============================================================================
+# web-build — Next.js production build → standalone output
+# ============================================================================
+FROM deps AS web-build
+COPY apps/web ./apps/web
+COPY packages/ai ./packages/ai
+COPY packages/database ./packages/database
+COPY packages/shared ./packages/shared
+COPY docker/next.config.docker.ts ./apps/web/next.config.ts
+
+# Force BuildKit to finish the two tsup builds before starting the heavy
+# Next.js compile. docker-compose's `depends_on` only orders runtime startup,
+# not `docker compose build` — without these COPYs, BuildKit runs all three
+# build stages in parallel and the host OOMs around the 73s mark of the web
+# build (kernel reaps with exit 255 and no Docker error, matching the warning
+# below about heap sizing). The copied files are throwaway markers; the
+# runtime web image never reads /tmp.
+COPY --from=collab-build /app/apps/collab-server/dist/index.mjs /tmp/.collab-built
+COPY --from=mcp-build /app/apps/mcp-server/dist/index.js /tmp/.mcp-built
+
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV NODE_ENV=production
+# Give the Next.js webpack compile enough V8 heap headroom on the Coolify host.
+# Sized to ~60% of an 8 GB host so kernel + dockerd + buildkit + concurrent
+# tsup workers still have breathing room. Below ~3 GB the compile spirals
+# into GC churn and gets oom-killed (exit 255 with no Docker error).
+ENV NODE_OPTIONS=--max-old-space-size=5120
+RUN pnpm exec turbo build --filter=@tasks/web
+
+
 # ============================================================================
 # web — runtime image (Next.js standalone)
 # ============================================================================

docker/docker-compose.coolify.yml

@@ -22,10 +22,15 @@
 #   The shared `deps` stage is hashed identically across targets, so BuildKit
 #   runs `pnpm install` ONCE.
 #
-#   `web` declares depends_on collab+mcp so Compose builds the lightweight
+#   The heavy `next build` for `web` (peak ~3 GB heap with 5 GB headroom)
-#   services first and the heavy `next build` (peak ~2.5 GB heap) gets the host
+#   must not race the two tsup builds for collab+mcp on the 8 GB Coolify
-#   effectively to itself instead of fighting concurrent runtime-stage COPYs
+#   host or the kernel OOM-kills it (exit 255 with no Docker error). Build
-#   for memory.
+#   ordering is enforced inside docker/Dockerfile: the `web-build` stage
+#   has explicit `COPY --from=collab-build` / `COPY --from=mcp-build` lines
+#   that force BuildKit's DAG to finish those two before starting the web
+#   compile. The `depends_on` below only orders runtime startup, NOT image
+#   builds — that was a misconception from an earlier iteration of this
+#   file.
 
 services:
   web: